Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation
CVE-2020-2049

7.8HIGH

Key Information:

Vendor
Palo Alto Networks
Status
Cortex Xdr Agent
Vendor
CVE Published:
9 December 2020

Summary

A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions.

Affected Version(s)

Cortex XDR Agent Windows 7.1.* without content update 150

Cortex XDR Agent Windows 7.2.* without content update 150

Cortex XDR Agent Windows 7.1.* with content update 150

References

https://security.paloaltonetworks.com/CVE-2020-2049
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Palo Alto Networks thanks Chris Au of PwC Hong Kong - Darklab and Xavier DANEST of Decathlon for discovering and reporting this issue.
.